What is claimed is: 



1 . A method of dynamically connecting a client node to a serving network, 
comprising the steps of: 

providing an access network to which a client node has a network connection; 

providing at least one access router having a network connection to said access 
network and having a network connection to at least one serving network; 

sending serving network provider advertising information to said client node; 

receiving from said client node serving network provider information specifying a 
serving network to which said client node desires access; and 

establishing a communication tunnel between said client node and said access 
router through said access network, such that said client node is able to send and 
receive data packets to and from the serving network specified by said client node 
within said communication tunnel through said access network. 

2. A method as set forth in claim 1 , further comprising the step of authenticating 
said client node prior to establishing said communication tunnel. 

3. A method as set forth in claim 1 , further comprising the step of providing a 
second access router having a network connection to said access network and having 
network connections to at least two serving networks. 

4. A method as set forth in claim 3, wherein when a serving network specified by 
said client node is associated with said second access router, said establishing step 
further comprises the step of binding said communication tunnel to said specified 
serving network associated with said second access router by using serving network 
information of said specified serving network as a security association identifier of said 
communication tunnel. 
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5. A method as set forth in claim 1 , wherein said access router has network 
connections to at least two serving networks, said method further comprising the step of 
establishing a second communication tunnel between said client node and said access 
router through said access network, such that said client node is able to selectively 
send and receive data packets to and from each of said two serving networks. 

6. A method as set forth in claim 1 , further comprising the step of providing a 
second access router having a network connection to said access network and a 
network connection to at least one serving network, said method further comprising the 
step of establishing a second communication tunnel between said client node and said 
second access router through said access network, such that said client node is able to 
selectively send and receive data packets to and from each of said serving networks 
associated with said access routers through said communication tunnels. 

7. A method as set forth in claim 1 , wherein said step of sending serving network 
provider advertising information comprises the step of using a PANA protocol. 

8. A method as set forth in claim 1 , wherein said step of sending serving network 
provider advertising information comprises the step of using a Router Discovery 
mechanism. 

9. A method as set forth in claim 1 , wherein said at least one serving network 
comprises an Internet Service Provider network. 
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10. A method as set forth in claim 1 , wherein said at least one serving network 
comprises a Network Access Provider network. 

11. A method as set forth in claim 1 , wherein said at least one serving network 
comprises a VLAN network. 

12. A method as set forth in claim 1 1 , further comprising the step of providing a 
virtual access point in said VLAN serving network, through which a client node may 
connect directly to said VLAN serving network. 

13. A method as set forth in claim 1, wherein said access network comprises an IP 
access network. 

14. A method as set forth in claim 1 , wherein said access network comprises a VLAN 
access network. 

15. A method as set forth in claim 14, wherein said VLAN access network is 
partitioned into multiple VLAN access sub-networks. 

16. A method as set forth in claim 14, further comprising the step of providing a 
virtual access point in said VLAN access network, through which a client node may 
connect to said VLAN access network. 

17. A method as set forth in claim 1 , wherein said client node connects to said 
access network via a remote network. 

18. A method as set forth in claim 1 , wherein the step of establishing said 
communication tunnel comprises the step of using an IPSec key management protocol. 
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19. A method as set forth in claim 1 , wherein said client node is a mobile node, and 
said network connection of said client node to said access network is a wireless 
connection. 

20. A method as set forth in claim 1 , wherein said communication tunnel is a secure 
communication tunnel. 

21 . A method as set forth in claim 20, further comprising the step of establishing said 
secure communication tunnel using an IPSec key management protocol. 

22. A method of connecting a client node to multiple Internet service providers, 
comprising the steps of: 

providing an access network through which said client node may communicate 
with said multiple Internet service providers; and 

establishing a separate communication tunnel within said access network for 
each of said multiple Internet service providers, such that said client node is able to 
send and receive data packets to and from each of said Internet service providers within 
said separate communication tunnels through said access network. 

23. A method as set forth in claim 22, wherein said communication tunnel is a secure 
communication tunnel. 

24. A method as set forth in claim 23, further comprising the step of establishing said 
secure communication tunnel using an IPSec key management protocol. 
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25. A method of connecting a client node to a serving network, comprising the steps 
of: 

providing an access router having a network connection to at least two serving 
networks; 

receiving from said client node serving network information specifying a serving 
network to which said client node desires to have access; 

establishing a communication tunnel between said client node and said access 
router through said access network, such that said client node is able to send and 
receive data packets to and from the serving network specified by said client node 
within said communication tunnel through said access network; and 

binding said communication tunnel to said specified serving network by using 
serving network information of said specified serving network as a security association 
identifier of said communication tunnel. 

26. A method as set forth in claim 25, wherein said communication tunnel is a secure 
communication tunnel. 

27. A method as set forth in claim 26, further comprising the step of establishing said 
secure communication tunnel using an IPSec key management protocol. 
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